Report by Intruder
2026 ASM Index: the most common attack surface exposures
Key Findings
26% of organizations leave MySQL databases exposed to the internet.
More than 1 in 7 organizations expose API documentation to the internet.
Midmarket organizations average 56 days to remove exposures, nearly four times slower than smaller enterprises.
15% of organizations leave WordPress admin panels internet-facing.
Organizations with over 5,000 employees manage almost 35 times more external assets than small enterprises with 51–250 employees.
8% of organizations leave phpMyAdmin internet-facing.
8% of organizations expose UPnP on the public internet.
Organizations with over 5,000 employees manage more than twice as many external assets as organizations with 1,000–5,000 employees.
9% of organizations expose SNMP on the public internet.
49% of organizations expose risky ports and services.
Retail firms average 10 days to remediate exposures.
Small organizations remediate vulnerabilities fastest, averaging 14–18 days to fix exposures.
Organizations in the 5,000–10,000 employee range average 56 days to remediate exposures.
Banks remediate exposures in 11 days on average.
The insurance sector requires nearly 50 days to remediate exposures.
Financial service organizations outside of banking require 24 days to remediate exposures.
Automotive and pharmaceutical sectors average 43 days to remediate exposures.